I wonder how strategic they're being in their choice of IPs returned. Sending a large number of invalid requests from IPs all over China to foreign servers could help in masking their hacking attempts against those servers.